CVE-2025-68057: 
WordPress vulnerability analysis and mitigation

CVE-2025-68057 is a Missing Authorization vulnerability in the e-plugins Hospital Doctor Directory WordPress plugin that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 1.3.9. The vulnerability was disclosed on January 22, 2026, by Patchstack. The CVSS v3.1 base score is 7.6 (High), as assigned by Patchstack (Patchstack).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. An authenticated attacker with low-level privileges can send crafted network requests to trigger restricted functionality without proper authorization checks. No complex conditions are required — the attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity. No public technical write-up or proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation can result in high integrity impact, with low confidentiality and availability impacts, according to the updated Patchstack CVSS vector. An attacker with a low-privilege WordPress account (e.g., subscriber) could manipulate or access data managed by the Hospital Doctor Directory plugin, potentially modifying doctor or hospital directory listings, accessing restricted information, or disrupting plugin functionality. The scope is limited to the affected WordPress installation and does not inherently enable lateral movement beyond the application layer.

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for CVE-2025-68057. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Feedly).

Users should update the Hospital Doctor Directory plugin to a version beyond 1.3.9 if a patched release is available from e-plugins. As an interim measure, site administrators should restrict plugin access to trusted roles only and audit user accounts with low-privilege roles (e.g., subscribers, contributors) for suspicious activity. If no patch is available, consider deactivating the plugin until a fix is released. Monitor the WordPress plugin repository and the Patchstack advisory for patch availability (Patchstack).